The vulnerability resides in the CIFS driver of the Linux kernel and involves missing reinitialization of local variables after a replay label. The flaw could cause the kernel to operate on undefined data, potentially leading to a crash or a denial‑of‑service condition. The issue is characterized by CWE‑908 (Improper Initialization) and CWE‑909 (Improper Initialization of Dynamic Objects) weaknesses; it does not explicitly provide a path for privilege escalation or data exfiltration.

Any Linux kernel build that does not include the commits starting with 14f66f4 is affected. The problem is confined to the CIFS component; other kernel subsystems are not impacted.

The CVSS score of 7.8 reflects high severity, while the EPSS score of < 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an adversary sending crafted SMB traffic that forces a replay, inferred from how the bug manifests in the CIFS driver.